Spring Core с Spring Security OAuth2resourceserver Вторая цепочка фильтров безопасности не активна ⇐ JAVA

[Anonymous]

Здравствуйте ВСЕ поддержкой, которую ценится,
i настроил Spring Core (5.3.39) с Spring Secuirty (5.8.16) для использования сервера ресурсов OAuth2, а сервер авторизации - KeyCloak. У меня есть ситуация, заказав цепочки фильтров безопасности, и использование Security Matchers не активировали BearertokenAuthenticationFilter of Second Chain. Как это сделано правильно? package edu.remad.tutoring2.security.config;

import java.util.HashMap;
import java.util.Map;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.DelegatingPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity(debug = true)
@EnableMethodSecurity
public class SpringSecurityConfig {

@Value("${spring.websecurity.debug:true}")
boolean webSecurityDebug;

@Bean
WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.debug(webSecurityDebug);
}

@Bean
PasswordEncoder passwordEncoder() {
String idForEncode = "bcrypt";
Map encoders = new HashMap();
encoders.put(idForEncode, new BCryptPasswordEncoder());

return new DelegatingPasswordEncoder(idForEncode, encoders);
}
}
< /code>
securityfilterchainsconfig.java:
package edu.remad.tutoring2.security.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.logout.HeaderWriterLogoutHandler;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
import org.springframework.security.web.header.HeaderWriterFilter;
import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter;
import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter.Directive;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import edu.remad.tutoring2.jwt.Tutoring2CustomJwtAuthenticationConverter;
import edu.remad.tutoring2.security.ContentSecurityPolicySettings;
import edu.remad.tutoring2.security.filters.DebugLoggingFilter;
import edu.remad.tutoring2.security.filters.HttpHeadersFilter;
import edu.remad.tutoring2.security.filters.TenantFilter;

@Configuration
public class SecurityFilterChainsConfig {

private static final ClearSiteDataHeaderWriter.Directive[] COOKIES = Directive.values();

@Autowired
private ContentSecurityPolicySettings contentSecurityPolicies;

@Autowired
private Tutoring2CustomJwtAuthenticationConverter jwtAuthConverter;

/**
* Does form login filter chain and has also http security.
*
* @param http similar to spring security xml config for filtering request
* @return created security filter chain, {@link SecurityFilterChain}
* @throws Exception
*/
@Bean
@Order(1)
SecurityFilterChain formloginSecurityFilterChain(HttpSecurity http) throws Exception {
http.cors().and().headers(headers -> headers.xssProtection().and()
.contentSecurityPolicy(contentSecurityPolicies.getContentSecurityPolicies()));

http.addFilterAfter(new TenantFilter(), BasicAuthenticationFilter.class)
.addFilterAfter(new HttpHeadersFilter(), HeaderWriterFilter.class)
.addFilterAfter(new DebugLoggingFilter(), HttpHeadersFilter.class)
.securityContext((securityContext) -> securityContext.requireExplicitSave(true))
.sessionManagement(
session -> session.maximumSessions(1).maxSessionsPreventsLogin(true).expiredUrl("/login"))
.authorizeRequests(requests -> requests.antMatchers("/", "/helloWorld", "/logoutSuccess", "/signup", "/api/v1/csrf")
.permitAll().antMatchers("/hello", "/bye", "/login", "/logout", "/templates/**").authenticated())
.formLogin(login -> login.loginPage("/myCustomLogin").loginProcessingUrl("/process-login")
.defaultSuccessUrl("/hello", true)).csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()))
.logout(logout -> logout.logoutUrl("/logout").logoutSuccessUrl("/logoutSuccess")
.addLogoutHandler(new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(COOKIES))));

return http.build();
}

@Bean
@Order(2)
SecurityFilterChain oauth2rescourceserverSecurityFilterChain(HttpSecurity http) throws Exception {
return http.securityMatcher(AntPathRequestMatcher.antMatcher("/v2/**"))
.authorizeHttpRequests(requests -> requests.anyRequest().authenticated()).csrf(csrf -> csrf.disable())
.oauth2ResourceServer(server -> server.jwt().jwtAuthenticationConverter(jwtAuthConverter))
.sessionManagement(management -> management.sessionCreationPolicy(SessionCreationPolicy.STATELESS)).build();
}
}
< /code>
oauth2resourcserverconfig.java:
package edu.remad.tutoring2.security.config;

import java.net.MalformedURLException;
import java.net.URL;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

import com.nimbusds.jose.KeySourceException;
import com.nimbusds.jose.proc.JWSAlgorithmFamilyJWSKeySelector;
import com.nimbusds.jose.proc.JWSKeySelector;
import com.nimbusds.jose.proc.SecurityContext;
import com.nimbusds.jwt.proc.DefaultJWTProcessor;

@Configuration
public class Oauth2ResourcServerConfig {

private String keySetUri = "http://192.168.120.59:8080/realms/Conne ... nect/certs";

@Bean
JwtDecoder jwtDecoder() throws KeySourceException, MalformedURLException {
JWSKeySelector jwsKeySelector =
JWSAlgorithmFamilyJWSKeySelector.fromJWKSetURL(new URL(keySetUri));

DefaultJWTProcessor jwtProcessor =
new DefaultJWTProcessor();
jwtProcessor.setJWSKeySelector(jwsKeySelector);

return new NimbusJwtDecoder(jwtProcessor);
}

}
< /code>
tutoring2customjwtauthentication converter.java:
package edu.remad.tutoring2.jwt;

import static edu.remad.tutoring2.appconstants.JwtAppConstants.JWT_CLAIM_RESSOURCE_ACCESS;
import static edu.remad.tutoring2.appconstants.JwtAppConstants.JWT_CONVERTER_PRINCIPAL_ATTRIBUTE;
import static edu.remad.tutoring2.appconstants.JwtAppConstants.JWT_CONVERTER_RESOURCE_ID;
import static edu.remad.tutoring2.appconstants.JwtAppConstants.JWT_ROLES_KEY;

import java.util.Collection;
import java.util.Map;
import java.util.Set;
import java.util.stream.Collectors;
import java.util.stream.Stream;

import org.springframework.core.convert.converter.Converter;
import org.springframework.lang.NonNull;
import org.springframework.security.authentication.AbstractAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtClaimNames;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.stereotype.Component;

/**
* Converts roles from Keycloak to Spring Security roles. It reads JWT and fetches all claims and roles as roles.
*/
@Component
public class Tutoring2CustomJwtAuthenticationConverter implements Converter {

private final JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter;

/**
* Default Constructor
*/
public Tutoring2CustomJwtAuthenticationConverter() {
jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
}

@Override
public AbstractAuthenticationToken convert(@NonNull Jwt jwt) {
Collection authorities = Stream
.concat(jwtGrantedAuthoritiesConverter.convert(jwt).stream(), extractJwtResourceRoles(jwt).stream())
.collect(Collectors.toSet());

return new JwtAuthenticationToken(jwt, authorities, getPrincipalClaimName(jwt));
}

private Collection

Подробнее здесь: https://stackoverflow.com/questions/795 ... filter-cha